Method and apparatus of dynamic loading file extraction for an application running in an android container

Abstract

Provided is a method and apparatus of dynamic loading file extraction. The method for extracting a specific dynamic generated file of an application running in an Android container environment includes conducting first analysis to identify if a file extension that is stored in the Android container corresponds to a preset critical extension, to extract a file with the critical extension, and conducting second analysis to identify a deleted file standing for a file deleted after stored in the Android container, and running the application again and extracting the deleted file based on a result of the second analysis.

What is claimed is: 
     
       1. A method of dynamic loading file extraction for an application running in an Android container, the method comprising:
 conducting a first analysis to determine whether a file has a file extension and is stored in the Android container and the file extension of the file corresponds to any of a predetermined group of file extensions and to extract the file having the file extension which corresponds to any of the predetermined group of file extensions; 
 conducting a second analysis to identify a deleted file which is stored in the Android container and deleted; and 
 re-executing the application and extracting the deleted file based on a result of the second analysis. 
 
     
     
       2. The method of dynamic loading file extraction according to  claim 1 , further comprising:
 monitoring the Android container to identify a file name and a storage path of any file that is stored in the Android container when the application runs. 
 
     
     
       3. The method of dynamic loading file extraction according to  claim 1 , further comprising:
 storing the extracted file in a separate path. 
 
     
     
       4. The method of dynamic loading file extraction according to  claim 1 , wherein the predetermined group of file extensions includes DEX, jar, zip, APK and SO. 
     
     
       5. The method of dynamic loading file extraction according to  claim 1 , wherein the second analysis comprising identifying if a deletion log is present in a memory log provided in a Linux host on which the Android container runs, and when there is the deletion log, identifying a file name and a storage path of the deleted file from the deletion log. 
     
     
       6. The method of dynamic loading file extraction according to  claim 1 , wherein the step of rerunning the application and the step of extracting the deleted file comprise re-executing the application and extracting the deleted file when the deleted file is present as a result of the second analysis. 
     
     
       7. The method of dynamic loading file extraction according to  claim 6 , wherein the step of the reexecuting the application and the step of the extracting the deleted file further comprise terminating file extraction when the deleted file is absent as a result of the second analysis. 
     
     
       8. The method of dynamic loading file extraction according to  claim 1 , wherein further comprising, identifying a file name and a storage path of the deleted file by conducting the second analysis, and, while the application re-executes, extracting the deleted file at the moment when the deleted file is being stored in the storage path of the deleted file. 
     
     
       9. An apparatus of dynamic loading file extraction for an application running in an Android container, the apparatus comprising:
 a processor and a memory; 
 a first extracting unit conducting a first analysis to determine whether a file has a file extension and is stored in the Android container and the file extension of the file corresponds to a predetermined group of file extensions and to extract the file having the file extension which corresponds to any of the predetermined group of file extensions; and 
 a second extracting unit conducting a second analysis to identify a deleted file which is stored in the Android container and deleted, to re-execute the application and to extract the deleted file based on a result of the second analysis. 
 
     
     
       10. The apparatus of dynamic loading file extraction according to  claim 9 , further comprising:
 a monitoring unit monitoring the Android container to identify a file name and a storage path of any file that is stored in the Android container when the application runs. 
 
     
     
       11. The apparatus of dynamic loading file extraction according to  claim 9 , further comprising:
 a file storing unit storing the file extracted by the first extracting unit and the second extracting unit in a separate path. 
 
     
     
       12. The apparatus of dynamic loading file extraction according to  claim 9 , wherein of the predetermined group of file extensions includes DEX, jar, zip, APK and SO. 
     
     
       13. The apparatus of dynamic loading file extraction according to  claim 9 , wherein the second extracting unit identifying if a deletion log is present in a memory log provided in a Linux host on which the Android container runs, and when there is the deletion log, and identifying a file name and a storage path of the deleted from the deletion log. 
     
     
       14. The apparatus of dynamic loading file extraction according to  claim 9 , wherein the second extracting unit re-executes the application and extracts the deleted file when the deleted file is present as a result of the second analysis, and terminates file extraction when the deleted file is absent as a result of the second analysis. 
     
     
       15. The apparatus of dynamic loading file extraction according to  claim 9 , wherein the second extracting unit identifies a file name and a storage path of the deleted file by conducting the second analysis, and while the application re-executes, extracts the deleted file at the moment when the deleted file is being stored in the storage path of the deleted file.